class lzu::server {
  # data2
  class { '::nfs':
    server_enabled => true
  }

  nfs::server::export{ '/data2':
    ensure  => 'mounted',
    clients => '192.168.0.0/16(rw,async,no_root_squash) localhost(rw)'
 }
  include autofs

  file {"/etc/auto.master.d/local.autofs":
    mode    =>  '644',
    owner   =>  'root',
    group   =>  'root',
    #source =>  "puppet:///modules/${module_name}/local.autofs",
    content => '/- /etc/auto.local --timeout=120'
  }->

  autofs::mapfile { 'lzu':
    path     => '/etc/auto.local',
    mappings => [
      { 'key' => '/home', 'options' => 'fstype=nfs,rw,soft,intr', 'fs' => '192.168.1.100:/home' },
    ]
  }
  #autofs
  augeas { "autofs_conf":
    context => "/files/etc/autofs.conf/autofs",
    changes => [
      "set browse_mode yes",
    ],
  }
  sysctl { "net.ipv4.ip_forward":
    ensure => present,
    value  => "1",
    target => "/etc/sysctl.d/ipforward.conf",
  }->

  firewall { '100 snat for network em1':
    chain    => 'FORWARD',
    iniface  => 'em1',
    action   => 'accept',
  }->
  firewall { '101 snat for network em1':
    chain    => 'POSTROUTING',
    jump     => 'MASQUERADE',
    proto    => 'all',
    outiface => 'em2',
    source   => '192.168.0.0/16',
    table    => 'nat',
  }->
  firewall { '000 accept all icmp requests':
    proto  => 'icmp',
    action => 'accept',
  }->
  firewall { '001 accept all to lo interface':
    proto   => 'all',
    iniface => 'lo',
    action  => 'accept',
  }->
  firewall { '002 reject local traffic not on loopback interface':
    iniface     => '! lo',
    proto       => 'all',
    destination => '127.0.0.1/8',
    action      => 'reject',
  }->
  firewall { '003 accept related established rules':
    proto  => 'all',
    state  => ['RELATED', 'ESTABLISHED'],
    action => 'accept',
  }->
  firewall { '100 accept internal network':
    chain   => 'INPUT',
    proto   => 'all',
    source  => '192.168.0.0/16',
    action  => 'accept',
  }->
  firewall { '100 accept IHEP network':
    chain   => 'INPUT',
    proto   => 'all',
    source  => '202.122.32.0/19',
    action  => 'accept',
  }->
  firewall { '100 accept locaal network':
    chain   => 'INPUT',
    proto   => 'all',
    source  => '210.26.48.0/23',
    action  => 'accept',
  }->
  firewall { '999 drop all other requests':
    proto  => 'all',
    action => 'drop',
  }

}
